feat(booth): refusal snapshots, subscriber access medium, one-car-one-ticket entry

Three booth-integrity improvements that share the entry/exit flows and activity log.

Refusal snapshots: previously only an accepted open captured a camera image; now
every refusal/hold anomaly fires the directional camera too (a turned-away car is
exactly the evidence wanted) — entry refused-full/held, exit refused
closed/no-session/unpaid/grace-expired (booth + reader paths), refused subscription.
A refused entry has no ticket id, so a synthetic REFUSED- ref keys the anomaly + photo
together. Same fire-and-forget contract; failed captures still show as tiles.

Subscriber access medium: the subscription flow already signed `via`
(qr|card|plate) into entry/exit payloads; surface it as a typed LedgerPayload.via, a
cyan chip in the ticker, and an "Entry medium" modal row (sq+en). Display-only.

One car = one ticket: the entry button could be mashed to mint many tickets per car
(corrupting occupancy + enabling ticket-shopping at exit) — the old #inFlight guard
only blocked overlapping presses. Add a per-relay guard configured on the relay spec:
PRESENCE mode (presenceInput ties ticketing to a vehicle loop on a Dingtian input —
one ticket per car, re-armed when the loop clears) or COOLDOWN fallback
(entryCooldownSec) when there's no barrier feedback. A suppressed press is unsigned
device_events telemetry, not a signed anomaly. SetupWizard exposes both fields.
Fail-closed entry and barrier-is-not-a-door invariants untouched; guard state is
in-memory/rebuildable, starts armed after restart.

Wiki: new entry-double-press; updated entry-exit-points, booth-console, index.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/entry-exit-points.md

@@ -30,6 +30,9 @@ config: {
 - `direction`: `entry` | `exit` | `both` (`both` = one barrier/relay serving in and out).
 - `button`: the **input terminal** the transient **entry button** is wired to. Only entry/both
   relays have one. Absent = no button at that barrier (subscriber/reader-driven only).
+- `presenceInput` / `entryCooldownSec`: the **one-car-one-ticket** guard for the entry button —
+  `presenceInput` is the input terminal of a vehicle-presence loop (physical guard), or
+  `entryCooldownSec` a fallback timer when there's no barrier feedback. See [[entry-double-press]].
 
 The four real layouts all fall out of this:
 
@@ -103,6 +106,18 @@ backed-up DB, nothing scattered on disk), in its own table so hot telemetry scan
 bytes and images prune independently. Linked to the signed `vehicle_entry/exit` by `identity`.
 Served read-only via `GET /api/snapshots/:id`. **Retention is unresolved** — see [[open-questions]].
 
+### Refused entry/exit ALSO snapshots (2026-06-19)
+A snapshot is evidence of **who was at the barrier** — which matters *most* when the barrier is
+**refused** (a turned-away car is a fraud/dispute signal: "lot full" denial, an unpaid exit attempt,
+a no-session ticket, an out-of-window subscription). Originally only the OPEN paths captured; now
+**every refusal/hold anomaly fires the directional camera too**, keyed to the same `identity` the
+anomaly carries so the [[booth-console|activity-log]] evidence strip finds it. Coverage: entry
+refused-full / held-no-ticket (a refused entry has no ticket id → mint a synthetic `REFUSED-…` ref
+to key the anomaly + photo together), exit refused closed/no-session/unpaid/grace-expired (booth
+*and* reader paths), and a refused [[subscription]] (the lane the reader sits at picks the camera).
+Same fire-and-forget contract — a refusal is never delayed by a camera. Failed captures still surface
+as "⚠ camera unreachable" tiles (see [[booth-console]]).
+
 ## Related
 
 [[entry-exit-readers]] · [[device-events]] · [[parking-session]] · [[anti-passback]] ·